diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index fde49b5..bc1fced 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -4119,7 +4119,8 @@
         "refs": [
           "https://www.helpnetsecurity.com/2016/11/22/cobalt-hackers-synchronized-atm-heists/",
           "https://www.bleepingcomputer.com/news/security/cobalt-hacking-group-tests-banks-in-russia-and-romania/",
-          "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"
+          "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish",
+          "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-september-cobalt-spider/"
         ],
         "synonyms": [
           "Cobalt group",